CheckPoint 156-215.81.20 Online Practice Questions and Exam Preparation

CheckPoint 156-215.81.20 Online Questions & Answers

• Question 201:

  What CLI utility allows an administrator to capture traffic along the firewall inspection chain?

  A. show interface (interface) 璫hain
  B. tcpdump
  C. tcpdump /snoop
  D. fw monitor
  D. fw monitor

• Question 202:

  SmartEvent does NOT use which of the following procedures to identity events:

  A. Matching a log against each event definition
  B. Create an event candidate
  C. Matching a log against local exclusions
  D. Matching a log against global exclusions
  C. Matching a log against local exclusions

  ---

  Explanation/Reference:

  Reference: https://sc1.checkpoint.com/documents/R76/CP_R76_SmartEvent_AdminGuide/17401.htm

• Question 203:

  What is Consolidation Policy?

  A. The collective name of the Security Policy, Address Translation, and IPS Policies.
  B. The specific Policy written in SmartDashboard to configure which log data is stored in the SmartReporter database.
  C. The collective name of the logs generated by SmartReporter.
  D. A global Policy used to share a common enforcement policy for multiple Security Gateways.
  B. The specific Policy written in SmartDashboard to configure which log data is stored in the SmartReporter database.

• Question 204:

  In which scenario is it a valid option to transfer a license from one hardware device to another?

  A. From a 4400 Appliance to an HP Open Server
  B. From an IBM Open Server to an HP Open Server
  C. From an 4400 Appliance to a 2200 Appliance
  D. From an IBM Open Server to a 2200 Appliance
  B. From an IBM Open Server to an HP Open Server

• Question 205:

  The fw monitor utility is used to troubleshoot which of the following problems?

  A. Phase two key negotiation
  B. Address translation
  C. Log Consolidation Engine
  D. User data base corruption
  B. Address translation

• Question 206:

  Which policy type is used to enforce bandwidth and traffic control rules?

  A. Threat Prevention
  B. QoS
  C. Threat Emulation
  D. Access Control
  B. QoS

• Question 207:

  You are the Security Administrator for MegaCorp. In order to see how efficient your firewall Rule Base is, you would like to see how many often the particular rules match. Where can you see it? Give the BEST answer.

  A. In the SmartView Tracker, if you activate the column Matching Rate.
  B. In SmartReporter, in the section Firewall Blade ?Activity>; Network Activity with information concerning Top Matched Logged Rules.
  C. SmartReporter provides this information in the section Firewall Blade ?Security>; Rule Base Analysis with information concerning Top Matched Logged Rules.
  D. It is not possible to see it directly. You can open SmartDashboard and select UserDefined in the Track column. Afterwards, you need to create your own program with an external counter.
  C. SmartReporter provides this information in the section Firewall Blade ?Security>; Rule Base Analysis with information concerning Top Matched Logged Rules.

• Question 208:

  Fill in the blank: Permanent VPN tunnels can be set on all tunnels in the community, on all tunnels for specific gateways, or__________.

  A. On all satellite gateway to satellite gateway tunnels
  B. On specific tunnels for specific gateways
  C. On specific tunnels in the community
  D. On specific satellite gateway to central gateway tunnels
  C. On specific tunnels in the community

  ---

  Explanation/Reference:

  Each VPN tunnel in the community may be set to be a Permanent Tunnel. Since Permanent Tunnels are constantly monitored, if the VPN tunnel is down, then a log, alert, or user defined action, can be issued. A VPN tunnel is monitored by periodically sending "tunnel test" packets. As long as responses to the packets are received the VPN tunnel is considered "up." If no response is received within a given time period, the VPN tunnel is considered "down." Permanent Tunnels can only be established between Check Point Security Gateways. The configuration of Permanent Tunnels takes place on the community level and:

  1.

  Can be specified for an entire community. This option sets every VPN tunnel in the community as permanent.

  2.

  Can be specified for a specific Security Gateway. Use this option to configure specific Security Gateways to have permanent tunnels.

  3.

  Can be specified for a single VPN tunnel. This feature allows configuring specific tunnels between specific Security Gateways as permanent.

  Reference: https://sc1.checkpoint.com/documents/R77/CP_R77_VPN_AdminGuide/html_frameset.htm?topic=documents/R77/CP_R77_VPN_AdminGuide/14018

• Question 209:

  What is Identity Sharing?

  A. Management servers can acquire and share identities with Security Gateways
  B. Users can share identities with other users
  C. Security Gateways can acquire and share identities with other Security Gateways
  D. Administrators can share identifies with other administrators
  C. Security Gateways can acquire and share identities with other Security Gateways

  ---

  Explanation/Reference:

  Identity Sharing

  Best Practice - In environments that use many Security Gateways and AD Query, we recommend that you set only one Security Gateway to acquire identities from a given Active Directory domain controller for each physical site. If more than

  one Security Gateway gets identities from the same AD server, the AD server can become overloaded with WMI queries.

  Set these options on the Identity Awareness > Identity Sharing page of the Security Gateway object:

  1.

  One Security Gateway to share identities with other Security Gateways. This is the Security Gateway that gets identities from a given domain controller.

  2.

  All other Security Gateways to get identities from the Security Gateway that acquires identities from the given domain controller.

  Reference: https://sc1.checkpoint.com/documents/R80.10/WebAdminGuides/EN/CP_R80.10_IdentityAwareness_AdminGuide/html_frameset.htm?topic=documents/R80.10/WebAdminGuides/EN/CP_R80.10_IdentityAwareness_AdminGuide/63005

• Question 210:

  Which deployment adds a Security Gateway to an existing environment without changing IP routing?

  A. Distributed
  B. Bridge Mode
  C. Remote
  D. Standalone
  B. Bridge Mode

  ---

  Explanation/Reference:

  Reference: https://sc1.checkpoint.com/documents/R76/CP_R76_Installation_and_Upgrade_Guide-webAdmin/86429.htm